Budget alert: the month's estimated AWS bill jumps from 1,500 to more than 60,000 dollars overnight

MasterLinux runs its course platform in the AWS account masterlinux-prod (503817264920), in the Paris (eu-west-3) region only: four application instances, an RDS database, a video bucket. The deployment pipeline uses the IAM user ci-deploy.

At 07:02, the AWS Budgets alert budget-mensuel-prod reached the on-call mailbox: forecasted spend for the month above 61,000 USD, for a budget of 1,500 USD. Nothing was released this weekend, the site answers normally. Last night, a developer "cleaned up and published" the deployment scripts repository to share it with the school.

Every hour that passes costs several hundred dollars. Management wants to know what is consuming, how it happened, and for it to stop now, without breaking production.

You are the on-call cloud security engineer, on ml-poste-01, with the AWS CLI v2 connected to the account (administrator profile through SSO, default region eu-west-3) and a clone of the repository masterlinux/outils-deploiement in ~/depots/outils-deploiement.